{{/*
NetworkPolicy — egress allowlist for cluster-autoscaler.

DEFAULT DISABLED: the apiserver Service CIDR + Hetzner-API CIDR are
cluster-specific and the umbrella chart cannot know them in advance.
Per-Sovereign overlays MAY flip
`clusterAutoscalerHcloud.networkPolicy.enabled: true` and supply the
matching CIDR allowlist for their region.
*/}}
{{- if .Values.clusterAutoscalerHcloud.networkPolicy.enabled }}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bp-cluster-autoscaler-hcloud
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-cluster-autoscaler-hcloud.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "bp-cluster-autoscaler-hcloud.selectorLabels" . | nindent 6 }}
  policyTypes:
    - Egress
  egress:
    # DNS — every egress flow needs DNS.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # Hetzner Cloud API — api.hetzner.cloud over HTTPS.
    - ports:
        - protocol: TCP
          port: 443
{{- end }}
